trustedjava-support

[Trustedjava-support] How to Encrypt by the private part of AIK

[FADY F. <fad...@ya...>]

Dear Trusted Java Team

I use the public part of AIK Key to encrypt a data and it works, I just ask how 
can I do it but by the private part of AIK.
This is my code
***************************************************************************

        // Context Object
        context = new TcTssContextFactory().newContextObject();
        context.connect();
       
        // get SRK and Set SRK Secret
        TcIRsaKey srk = 
context.loadKeyByUuidFromSystem(TcUuidFactory.getInstance().getUuidSRK());
        TcIPolicy srkUsgPolicy = 
context.createPolicyObject(TcTssConstants.TSS_POLICY_USAGE);
        TcBlobData srkSecret = 
TcBlobData.newByteArray(TcTssConstants.TSS_WELL_KNOWN_SECRET);
        srkUsgPolicy.setSecret(TcTssConstants.TSS_SECRET_MODE_SHA1, srkSecret);
        srkUsgPolicy.assignToObject(srk);
        
        // Load AIK
        TcIRsaKey aikKey = context.loadKeyByBlob(srk, keyblob_);
        
        //Set Usage and Migration Policy
        TcIPolicy aikUsgPolicy = 
context.createPolicyObject(TcTssConstants.TSS_POLICY_USAGE);
        
aikUsgPolicy.setSecret(TcTssConstants.TSS_SECRET_MODE_PLAIN,TcBlobData.newString(keysecret));

        aikUsgPolicy.assignToObject(aikKey);
        TcIPolicy aikMigPolicy = 
context.createPolicyObject(TcTssConstants.TSS_POLICY_MIGRATION);
        
aikMigPolicy.setSecret(TcTssConstants.TSS_SECRET_MODE_PLAIN,TcBlobData.newString(keysecret));

        aikMigPolicy.assignToObject(aikKey);

         //Encrypt by the public Part of AIK
        TcTpmPubkey pubKey = new TcTpmPubkey (aikKey.getAttribData (
                                                             
TcTssConstants.TSS_TSPATTRIB_KEY_BLOB,                                

                                                             
TcTssConstants.TSS_TSPATTRIB_KEYBLOB_PUBLIC_KEY));
        String plaintext = "Daten";        
        try {
            TcBlobData data;
            data = TcBlobData.newByteArray(plaintext.getBytes("UTF_16LE"));
            System.out.println(data.toString());
            TcBlobData DataEncrypted = 
TcCrypto.pubEncryptRsaOaepSha1Mgf1(pubKey, data);
            //TcBlobData DataEncrypted= 
TcCrypto.pubEncryptRsaEcbPkcs1Padding(pubKey, Data);
            System.out.println(DataEncrypted.toString());
        } catch (UnsupportedEncodingException ex) {
            Logger.getLogger(APKIC1.class.getName()).log(Level.SEVERE, null, 
ex);
        }

***************************************************************************

Thank You Very Much
I  Really appreciate your help.

Thanks


      

Re: [Trustedjava-support] How to Encrypt by the private part of AIK

[Ronald T. <ron...@ia...>]

Hi,

I'm not quite sure what your question is. In case that you'd like to use 
the AIK private part for decryption, I doubt that this is a legal 
operation for this signing-type key. If you need to encrypt data to an 
TPM-identified remote host, you can use Binding together with 
certification of the Binding key.

hth,
Ronald

On 10/17/2010 11:24 AM, FADY FADY wrote:
>
> I use the public part of AIK Key to encrypt a data and it works, I 
> just ask how can I do it but by the private part of AIK.
>


-- 
Dipl.-Ing. Ronald Tögl          phone +43 316/873-5502
Secure and Correct Systems      fax   +43 316/873-5520
IAIK                            ron...@ia...
Graz University of Technology   http://www.iaik.tugraz.at

Re: [Trustedjava-support] How to Encrypt by the private part of AIK

[FADY F. <fad...@ya...>]

Dear Ronald
Thank U for your response

My Question is 
If we have two entities 1 and 2 with Keys AIK1 and AIK2 respectively
can entity 1 sign by AIK1private then encrypt by AIK2public
  so entity 2 decrypt by AIK2private then by AIK1public?

If this cant not be done, can we make two binding keys where there parents are 
AIK1 and AIK2 respectively, and do by these binding keys what we try to do by 
AIKs in the first question?

Thanks 



________________________________
From: Ronald Tögl <ron...@ia...>
To: tru...@li...
Cc: FADY FADY <fad...@ya...>
Sent: Mon, October 18, 2010 10:10:07 AM
Subject: Re: [Trustedjava-support] How to Encrypt by the private part of AIK

Hi,

I'm not quite sure what your question is. In case that you'd like to use the AIK 
private part for decryption, I doubt that this is a legal operation for this 
signing-type key. If you need to encrypt data to an TPM-identified remote host, 
you can use Binding together with certification of the Binding key.

hth,
Ronald

On 10/17/2010 11:24 AM, FADY FADY wrote: 

>I use the public part of AIK Key to encrypt a data and it works, I just ask how 
>can I do it but by the private part of AIK.
>


--  Dipl.-Ing. Ronald Tögl          phone +43 316/873-5502 Secure and Correct 
Systems      fax   +43 316/873-5520 IAIK                            
ron...@ia... Graz University of Technology   
http://www.iaik.tugraz.at   



      

Re: [Trustedjava-support] How to Encrypt by the private part of AIK

[Ronald T. <ron...@ia...>]

Hello,

On 10/20/2010 02:24 PM, FADY FADY wrote:
> Dear Ronald
> Thank U for your response
>
> My Question is
> If we have two entities 1 and 2 with Keys AIK1 and AIK2 respectively
> can entity 1 sign by AIK1private then encrypt by AIK2public
> so entity 2 decrypt by AIK2private then by AIK1public?
This cannot be done, because AIKs can only sign but not encrypt.

> If this cant not be done, can we make two binding keys where there
> parents are AIK1 and AIK2 respectively, and do by these binding keys
> what we try to do by AIKs in the first question?
Yes. You can implement the scheme presented in
"Securing the Distribution and Storage of Secrets with Trusted Platform 
Modules" by Paul E. Sevinç, Mario Strasser and David Basin. 
http://www.springerlink.com/content/b77jr665x9122q16/

Depending on your use case, you might want to modify it according to
"Formal Analysis of a TPM-Based Secrets Distribution and Storage Scheme"
by Toegl, R.;   Hofferek, G.;   Greimel, K.;   Leung, A.;   Phan, 
R.C.-W.;   Bloem, R.;
http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4709329&tag=1

Have fun,
Ronald


-- 
Dipl.-Ing. Ronald Tögl          phone +43 316/873-5502
Secure and Correct Systems      fax   +43 316/873-5520
IAIK                            ron...@ia...
Graz University of Technology   http://www.iaik.tugraz.at